Need to encrypt VM's that use KVM Virtualisation

The ultimate goal is that the server's owner could not get into the machine that he's spinning, he is only allowed to press On / Off In theory, we think as follows. There are 2 machines VM1 and VM2: 1) The application and the database require presence on VM1 2) VNC to VM1 and VM2 only by password must be 3) VM1 and VM2 disks must be encrypted. 4) VM1 is loaded only when VM2 is running, in VM1 GRUB asks each time the generated start key for VM2 and remembers it, that would not happen again (Holds the last 500 entries). 5) VM2 is a self-contained small machine with Secure boot and its own downloadable key in a separate section. 6) It requires preliminary consultation and further implementation of the project, you must have experience working with encryption.